311-350

A new security engineer has started hardening systems. One of the hardening techniques the engineer is using involves disabling remote logins to the NAS. Users are now reporting the inability to use SCP to transfer files to the NAS, even though the data is still viewable from the users PCs. Which of the following is the MOST likely cause of this issue?

• (A). TFTP was disabled on the local hosts

• (B). SSH was turned off instead of modifying the configuration file

• (C). Remote login was disabled in the networkd.config instead of using the sshd.conf

• (D). Network services are no longer running on the NAS

A small business just recovered from a ransomware attack against its file servers by

purchasing the decryption keys from the attackers. The issue was triggered by a phishing email and

the IT administrator wants to ensure it does not happen again. Which of the following should the IT

administrator do FIRST after recovery?

• (A). Scan the NAS for residual or dormant malware and take new daily backups that are tested on a

  frequent basis

• (B). Restrict administrative privileges and patch ail systems and applications.

• (C). Rebuild all workstations and install new antivirus software

• (D). Implement application whitelisting and perform user application hardening

An analyst is trying to identify insecure services that are running on the internal network. After performing a port scan the analyst identifies that a server has some insecure services enabled on default ports. Which of the following BEST describes the services that are currently running and the secure alternatives for replacing them' (Select THREE)

• (A). SFTP FTPS

• (B). SNMPv2 SNMPv3

• (C). HTTP, HTTPS

• (D). TFTP FTP

• (F). Telnet SSH

A user enters a password to log in to a workstation and is then prompted to enter an authentication code. Which of the following MFA factors or attributes are being utilized in the authentication process? (Select TWO).

• (A). Something you know

• (B). Something you have

• (C). Somewhere you are

• (D). Someone you are

• (E). Something you are

As part of the lessons-learned phase, the SOC is tasked with building methods to detect if a previous incident is happening again. Which of the following would allow the security analyst to alert the SOC if an event is reoccurring?

• (A). Creating a playbook within the SOAR

• (B). Implementing rules in the NGFW

• (C). Updating the DLP hash database

• (D). Publishing a new CRL with revoked certificates

A security engineer is installing a WAF to protect the company's website from malicious web requests over SSL. Which of the following is needed to meet the objective?

• (A). A reverse proxy

• (B). A decryption certificate

• (C). A split-tunnel VPN

• (D). Load-balanced serv

A security analyst needs to generate a server certificate to be used for 802.1X and secure RDP connections. The analyst is unsure what is required to perform the task and solicits help from a senior colleague. Which of the following is the FIRST step the senior colleague will most likely tell the analyst to perform to accomplish this task?

• (A). Create an OCSP

• (B). Generate a CSR

• (C). Create a CRL

• (D). Generate a .pfx file

An organization wants to host an externally accessible web server that will not contain sensitive user information. Any sensitive information will be hosted on file servers. Which of the following is the BEST architecture configuration for this organization?

• (A). Host the web server in a DMZ and the file servers behind a firewall

• (B). Host the web server and the file servers in a DMZ

• (C). Host the web server behind a firewall and the file servers in a DMZ

• (D). Host both the web server and file servers behind a firewall

Which of the following should be monitored by threat intelligence researchers who search for leaked credentials?

• Common Weakness Enumeration

• OSİNT

• Dark Web

• Vulnerability Databases

A customer service representative reported an unusual text message that was sent to the help desk. The message contained an unrecognized invoice number with a large balance due and a link to click for more details. Which of the following BEST describes this technique?

• (A). Vishing

• (B). Whaling

• (C). Phishing

• (D). Smishing